PT-2015-7473

CVE-2015-7094

Published

2015-12-11

Updated

2017-09-13

Description by

CVSS 2.0

2.6

Low

MetricsAV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.2 Apple OS X versions prior to 10.11.2

Description The issue allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL, specifically affecting the CFNetwork HTTPProtocol.

Recommendations For Apple iOS versions prior to 9.2, update to version 9.2 or later. For Apple OS X versions prior to 10.11.2, update to version 10.11.2 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation